WatchGuard Firebox System 4.6 User Guide

CHAPTER 11Setting Up Logging andNotificationLogging and notification are crucial to an effective network security policy. Together,they make it possible to monitor your network security, identify both attacks andattackers, and take action to address security threats and challenges.Logging occurs when the firewall records the occurrence of an event to a log file.Notification occurs when the firewall sends e-mail, pops up a window on the EventProcessor, or dials a pager to notify an administrator that WatchGuard detected atriggering event.WatchGuard logging and notification features are both flexible and powerful. Youcan configure your firewall to log and notify on a wide variety of events, includingspecific events at the level of individual services.Ensure logging with failover loggingWatchGuard relies on failover logging to minimize the possibility of missing logevents. With failover logging, you configure a list of Event Processors to accept logsin the event of a failure of the primary Event Processor. By default, the Firebox sendslog messages to the primary Event Processor. If for any reason the Firebox cannotestablish communication with the primary Event Processor, it automatically sendsUser Guide 69